It seems that while ZoneAlarm Extreme 2012 is running (Win XP Pro SP3) it (vsmon.exe) has the following TCP connections from my machine, currently private net IP as follows:

C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (1168)
Local CLOSE-WAIT Remote (HTTP)
Local CLOSE-WAIT Remote (HTTP)
Why would ZoneAlarm need such connections.? What is it reporting home?

It is not, at the moment, checking for an update nor downloading one.